diff --git a/module/apache/module.sh b/module/apache/module.sh
index 7506a51..6c932af 100644
--- a/module/apache/module.sh
+++ b/module/apache/module.sh
@@ -363,8 +363,9 @@
 function __finalise_install
 {
 	[ ! -f "$1/$clean_skiptag_sh" ] || {
-		pushd "$1" &>/dev/null && \
-			source "$1/$clean_skiptag_sh" && popd &>/dev/null
+		pushd "$1" &>/dev/null || return $s_err
+		sudo -E /bin/bash "$1/$clean_skiptag_sh"
+		popd &>/dev/null
 	}
 }
 
@@ -381,22 +382,22 @@
 		case "$target" in
 			pelican-html)
 				INSTALLDIR=$views_d \
-				make install-html   || return $s_err ;;
+				sudo -E make install-html   || return $s_err ;;
 			pelican-theme)
 				INSTALLDIR_THEME=$html_d \
-				make install-theme  || return $s_err ;;
+				sudo -E make install-theme  || return $s_err ;;
 			pelican-photos)
 				INSTALLDIR_PHOTOS=$photos_d \
-				make install-photos || return $s_err ;;
+				sudo -E make install-photos || return $s_err ;;
 			pelican-videos)
 				INSTALLDIR_VIDEOS=$videos_d \
-				make install-videos || return $s_err ;;
+				sudo -E make install-videos || return $s_err ;;
 			pelican-all)
 				INSTALLDIR=$views_d \
 				INSTALLDIR_THEME=$html_d \
 				INSTALLDIR_PHOTOS=$photos_d \
 				INSTALLDIR_VIDEOS=$videos_d \
-				make install || return $s_err
+				sudo -E make install || return $s_err
 
 				# FIXME: improve integration with skiptag
 				__finalise_install $photos_d || \
@@ -405,6 +406,33 @@
 					lets -l -e "Failed to finalise videos" ;;
 		esac
 	done
+
+	# Default in Linux in www-data, apply to all installed contents here
+	local -ir uid=$(stat -c "%u" $html_d)
+	local -ir gid=$(stat -c "%g" $html_d)
+
+	sudo find $html_d -type f -exec /bin/bash -c \
+	     "set -x; chmod 644 {} && chown $uid:$gid {}" \; || return $s_err
+	sudo find $views_d -type f -exec /bin/bash -c \
+	     "set -x; chmod 644 {} && chown $uid:$gid {}" \; || return $s_err
+	sudo find $html_d -type d -exec /bin/bash -c \
+	     "set -x; chmod 755 {} && chown $uid:$gid {}" \; || return $s_err
+	sudo find $views_d -type d -exec /bin/bash -c \
+	     "set -x; chmod 755 {} && chown $uid:$gid {}" \; || return $s_err	
+
+	if [ -d "$photos_d" ]; then
+	    sudo find $photos_d -type f -exec /bin/bash -c \
+		 "set -x; chmod 644 {} && chown $uid:$gid {}" \; || return $s_err
+	    sudo find $photos_d -type d -exec /bin/bash -c \
+		 "set -x; chmod 755 {} && chown $uid:$gid {}" \; || return $s_err
+	fi
+
+	if [ -d "$videos_d" ]; then
+	    sudo find $videos_d -type f -exec /bin/bash -c \
+		 "set -x; chmod 644 {} && chown $uid:$gid {}" \; || return $s_err
+	    sudo find $videos_d -type d -exec /bin/bash -c \
+		 "set -x; chmod 755 {} && chown $uid:$gid {}" \; || return $s_err
+	fi
 }
 
 function __create_apache_frontend
@@ -467,11 +495,26 @@
 	for target in ${CODEIGN_INSTALL_TARGETS[@]}; do
 		case "$target" in
 			codeign-all)
-				cp -ra $backend_d/application $www_d || return $s_err2
-				cp -ra $backend_d/system $www_d      || return $s_err3
-				cp -a $backend_d/index.php $html_d   || return $s_err4 ;;
+				sudo -E cp -ra $backend_d/application $www_d || return $s_err2
+				sudo -E cp -ra $backend_d/system $www_d      || return $s_err3
+				sudo -E cp -a $backend_d/index.php $html_d   || return $s_err4 ;;
 		esac
 	done
+
+	# Default in Linux in www-data, apply to all installed contents here
+	local -ir uid=$(stat -c "%u" $html_d)
+	local -ir gid=$(stat -c "%g" $html_d)
+
+	sudo find "$www_d/application" -type f -exec /bin/bash -c \
+	     "set -x; chmod 644 {} && chown $uid:$gid {}" \; || return $s_err
+	sudo find "$www_d/application" -type d -exec /bin/bash -c \
+	     "set -x; chmod 755 {} && chown $uid:$gid {}" \; || return $s_err
+	sudo find "$www_d/system" -type f -exec /bin/bash -c \
+	     "set -x; chmod 644 {} && chown $uid:$gid {}" \; || return $s_err
+	sudo find "$www_d/system" -type d -exec /bin/bash -c \
+	     "set -x; chmod 755 {} && chown $uid:$gid {}" \; || return $s_err
+	sudo chmod 644 "$html_d/index.php"
+	sudo chown $uid:$gid "$html_d/index.php"
 }
 
 function __create_apache_backend
diff --git a/module/mysql/module.sh b/module/mysql/module.sh
index 11215bd..de28468 100644
--- a/module/mysql/module.sh
+++ b/module/mysql/module.sh
@@ -160,12 +160,15 @@
 	# Duplicate ca as it needs to be mounted client side
 	cp -ar $ca_f $ca_dup_f
 
-	set_mode "0644" $mysql_uid \
-			 $ca_f $ca_dup_f \
-			 $server_key_f $server_req_f $server_cert_f \
-			 $client_key_f $client_req_f $client_cert_f || return $s_err
+	set_mode "0644" $mysql_uid $ca_f \
+		 $server_key_f $server_req_f $server_cert_f || return $s_err
+
+	# WARNING! The only client expected is apache. This can break other clients
+	set_mode "0644" "www-data" \
+		 $ca_dup_f $client_key_f $client_cert_f || return $s_err
 
 	set_mode "0600" $mysql_uid $ca_key_f || return $s_err
+	set_mode "0755" root $certificates_d || return $s_err
 }
 
 function __mysql_do_dummy_cert